Servicio de Rentas Internas, QuitoRol: Analista de Infraestructura y OperacionesEmpresa: El Servicio de Rentas Internas es la institución que seencarga de gestionar la polĆtica tributaria, asegurando larecaudación destinada al fomento de la cohesión social.ResponsabilidadesEnlaces WanConfiguración Router Switch CiscoBalanceador de carga F5WebsenseCheckpointAdministración de Servidores WindowsVMwareProyectos mĆ”s relevantes:Administración Wireless Lan ControllerAdministración Optimizadores RiverbedAdministración Proceso Gestión de EventosEspecialista de Infraestructura y Operacionesene 2017 - may 2022Servicio de Rentas Internas, QuitoRol: Especialista de Infraestructura y OperacionesEmpresa: El Servicio de Rentas Internas es la institución que seencarga de gestionar la polĆtica tributaria, asegurando larecaudación destinada al fomento de la cohesión social.ResponsabilidadesAdministración de Servidores Windows, Linux y SolarisVMwareNetappComponentes HP, CiscoElasticsearchProyectos mĆ”s relevantes:Administración Contratos SERCOP y BIDAdministración Proceso Gestión de EventosLĆder de Proyecto - Implementación cliente de correo - Software LibreMiembro del Proyecto - Migración Servidores Base de Datos a la Plataforma SolarisExperto Nacional de Infraestructura y Operacionesjun 2022 - presenteServicio de Rentas Internas, QuitoRol: Experto Nacional de Infraestructura y OperacionesEmpresa: El Servicio de Rentas Internas es la institución que seencarga de gestionar la polĆtica tributaria, asegurando larecaudación destinada al fomento de la cohesión social.ResponsabilidadesAdministración de Servidores Windows, Linux y SolarisAdministración de AnsibleAdministración de SiteScopeAdministración de VMwareAdministración de NetappAdministración de Componentes HP, UCS CiscoAdministración de ElasticsearchAdministración de SatelliteAdministración de Identity Management Red HatAdministración de OPSAdministración de Wazuh
PUBLICACIONESSoftware Quality Assessment Applied for the Governmental Organizations using ISO/IEC 25000abr 2018 - abr 2018Conferencia ICEDEG / Indexado ScopusABSTRACT: The objective of this paper is to share our experience inapplying the ISO/IEC 25000 standard for the evaluation of softwarequality requirements. In this case study, Outlook Web Access (OWA)and Thunderbird will be evaluated as possible e-mail solutions foral real governmental institution, considering their technical andfunctional characteristics such as assistance for configuring mailaccounts, address book, message file, robust privacy, protectionagainst identity spoofing, automatic update, garbage removal,integration with Exchange and folder management to back upinformation. In this scenario, Outlook Web Access and Thunderbirdhave been selected as candidateās due to their main advantagese.g. integration with Microsoft Exchange and Open sourcecharacteristic, respectively. This work provides an interestingillustration of ISO/IEC 25000 implementation in a GovernmentalInstitution detai ling its benefits as a method to assessing softwarequality.Cybersecurity in DevOps Environments: A Systematic Literature Reviewjun 2025 - jun 2025Access-2025-22631/IEEE ACCESSABSTRACT: This systematic literature review provides acomprehensive analysis of the most criticalcybersecuritychallenges in DevOps environments. Through a rigorousexamination of 62 peer-reviewedarticles published between 2016and 2025, we identified recurring threats, active attack vectors,structuralvulnerabilities, mitigation strategies, and their technicalimpact on system performance and operationalresilience. Theanalysis revealed that the most significant threats are related touncontrolled automation,exposure of sensitive secrets in CI/CDpipelines, lack of mutual authentication between distributedservices,supply chain attacks, and the use of unauthorized tools(Shadow IT). These threats simultaneouslycompromise coresecurity principles, including integrity, confidentiality, andtraceability. The most frequentattack vectors include code injectionin CI/CD pipelines, unrestricted access to public repositories,remoteexecution via default configurations, and lateral movement in flatarchitectures. We identified27 recurrent vulnerabilities throughoutthe DevOps lifecycle. The most critical include the absenceofautomated security testing, poor management of secrets, andreliance on unverified third-party components.More than 30technical and organizational countermeasures were documented,such as SAST/DAST/IASTscans, infrastructure-as-code validation,secure credential storage via vaults, and integrated practiceslikeDevSecOps and compliance-as-code. When properlyimplemented, these strategies do not degradesystemperformance and may even enhance resilience andstability. Nonetheless, a lack of comparative empiricalvalidation inmost reviewed studies limits the generalizability of proposedsolutions. These findings establish a foundation for future researchin emerging domains, such as the Internet of Things, wherecontinuous, adaptive, and verifiable security is paramount forautomated and dynamic environments.
Toward a Robust and Enhanced DevSecOps Frameworkjul 2025 - jul 2025Springer Nature LinkABSTRACT: The increasing dynamism and complexity of modernsoftware development environments, driven by continuousintegration and delivery practices, have revealed critical limitationsin traditional security models. In this context, DevSecOps hasemerged as a strategic paradigm for integrating security in acontinuous, automated, and comprehensive manner throughoutthe DevOps cycle. However, its effective adoption faces multipletechnical and methodological challenges, including the lack ofempirically validated frameworks that ensure practicalapplicability.This study presents a systematic review of scientificand industrial literature published between 2018 and 2025, aimingto identify existing DevSecOps frameworks, their automationmechanisms, security practices, and reported limitations. Theresearch examines cybersecurity gaps across all DevOps stages,from planning to monitoring, with particular attention totraceability, maturity, regulatory compliance, and operationalresilience.The analysis identifies technical gaps, organizationalshortcomings, and challenges related to the integration of securitytools, control automation, and maturity evaluation. These findingsprovide a rigorous scientific basis for developing an enhancedframework, guiding future research towardmore robust, verifiable,and adaptable DevSecOps implementations.DOCENCIAProfesor titular Instituto Tecnológico Internacional UniversitarioAño: ActualidadCERTIFICACIONESBusiness Intelligence Foundationago 2023CertiProfID de la credencial 88281680Lifelong Learningjul 2023CertiprofRWPCjul 2023CertiprofID de la credencial 87860864Scrum Foundation Professional Certificatejul 2023CertiprofID de la credencial 87707434Business Model Canvas Essentialsene 2024CertiProfID de la credencial 92971014Cybersecurity Awareness Professional Certification CAPCago 2024CertiProf
ID de la credencial 57OOffOaEthical Hacking Professional Certification CEHPCoct 2024CertiProfID de la credencial JLRKRFHLPHJ-WTVNWBVHZ-YQSWQBSTSSPrompt Engineering Foundationnov 2024CertiProfID de la credencial 101867730Lead Cybersecurity Professional Certification LCSPCnov 2024CertiProfID de la credencial TLZVZLDZSGS-XWMTHWRTM-RDJPFRKPRTISO/IEC 27001:2022 Certified Lead Implementer I27001CLInov 2024CertiProfID de la credencial CLPSPNDBFYD-ZJLJHHVZQ-XTYSYPTSHMBusiness Agility Professional Certification BAPCnov 2024Introducción a la Seguridad de la Informaciónmar 2025Movistar (Telefónica Hispam)ID de la credencial e33678cb-2c2a-41af-bb87-7280249fbb67Introducción a Ciberseguridadmar 2025Movistar (Telefónica Hispam)ID de la credencial 34836323-c9ff-4133-9843-141452a996c5Gobierno y gestión de la seguridad de la informaciónmar 2025Movistar (Telefónica Hispam)ID de la credencial a6c4b0c8-00c3-4d7b-8694-c4cf9a07abba